Issuer

"wellKnownEndpoint": configuration expression<url>, required unless authorizeEndpoint and tokenEndpoint are configured

The URL to the well-known configuration resource described in OpenID Connect 1.0 Discovery.

"idTokenVerificationSecretId": configuration expression<string>, optional

When OpenID Connect ID token signature validation is enabled on the ClientRegistration and no "wellKnownEndpoint" is set, set this to reference the provider’s public key for asymmetric ID token signature validation.

If the OpenID provider uses a symmetric (HMAC-based) signature algorithm, the symmetric key is the client secret. Configure the client secret ID in the ClientRegistration instead.

This secret ID must point to a CryptoKey in the "secretsProvider".

Default: Use the jwks_uri in the well-known configuration to get the asymmetric signature validation keys and ignore this setting.

"secretsProvider": SecretsProvider reference, required when idTokenVerificationSecretId is set

The SecretsProvider to query for the signature validation secret.

Default: Use the jwks_uri in the well-known configuration to get the asymmetric signature validation keys and ignore this setting.

"authorizeEndpoint": configuration expression<url>, required unless obtained through wellKnownEndpoint

The URL to the provider’s OAuth 2.0 authorization endpoint.

"registrationEndpoint": configuration expression<url>, optional

The URL to the provider’s OpenID Connect dynamic registration endpoint.

"tokenEndpoint": configuration expression<url>, required unless obtained through wellKnownEndpoint

The URL to the provider’s OAuth 2.0 token endpoint.

"userInfoEndpoint": configuration expression<url>, optional

The URL to the provider’s OpenID Connect UserInfo endpoint.

Default: no UserInfo is obtained from the provider.

"endSessionEndpoint": configuration expression<url>, optional

The URL to the Authorization Server’s end_session_endpoint. In OpenID Connect, when a request accesses this endpoint, PingGateway kills the user session in AM.

Example endpoint: https://am.example.com:8443/openam/oauth2/realms/root/realms/alpha/connect/endSession

Learn more in OpenID Connect Session Management.

Default: No endpoint

"revocationEndpoint": configuration expression<url>, optional

The URL to the Authorization Server’s revocation_endpoint. When a request accesses this endpoint, PingGateway revokes access tokens or refresh tokens associated with the current user session in AM.

Example endpoint: https://am.example.com:8443/openam/oauth2/realms/root/realms/alpha/token/revoke

Default: No endpoint

"issuer": configuration expression<string>, required for OIDC unless obtained through the wellKnownEndpoint

The identifier of the issuer for OpenID Connect ID tokens. This must match the iss claim value in the ID tokens.

Default: Use the issuer in the well-known configuration.

"issuerHandler": Handler reference, optional

Invoke this HTTP client Handler to communicate with the Authorization Server.

Provide the name of a Handler object defined in the heap or an inline handler configuration object.

Set this to the name of a ClientHandler configured in the heap or a Chain that ends in a ClientHandler.

Default: PingGateway uses the default ClientHandler.

"issuerRepository": Issuer repository reference, optional

A repository of OAuth 2.0 issuers, built from discovered issuers and the PingGateway configuration.

Provide the name of an IssuerRepository object defined in the heap.

Default: Look up an issuer repository named IssuerRepository in the heap. If none is explicitly defined, PingGateway creates a default one named IssuerRepository in the current route.

"useDeprecatedIssuerRepository": configuration expression<boolean>, optional

Whether to use the deprecated default "IssuerRepository" from the heap.

Default: true

"supportedDomains": array of patterns, optional

One or more domain patterns to match domain names that are handled by this issuer used as a shortcut for OpenID Connect discovery before performing OpenID Connect dynamic registration.

When the OpenID Provider isn’t known in advance, PingGateway can discover the OpenID Provider Issuer based on information provided by the user, such as an email address. The OpenID Connect discovery specification explains how to use WebFinger to discover the issuer. PingGateway can discover the issuer in this way. As a shortcut, PingGateway can also use the supported domains to find issuers already described in the PingGateway configuration.

To use this shortcut, PingGateway extracts the domain from the user input and looks for an issuer whose supported domains list contains a match.

Supported domains patterns match host names with optional port numbers. Don’t specify a URI scheme such as HTTP. PingGateway adds the scheme. For instance, *.example.com matches any host in the example.com domain. You can specify the port number as well as in host.example.com:8443. Patterns must be valid regular expression patterns according to the rules for the Java Pattern class.

"idTokenSkewAllowance": configuration expression<duration>, optional

Acceptable clock skew when validating OpenID Connect ID Tokens.

Default: zero